Privacy Policy
Clear information about how Cranfield Aviation processes personal data across our website, training operations, cloud infrastructure, customer systems and digital communications.
Privacy by design across our digital operations.
We process personal data when you visit our website, request information, enrol in training, communicate with us, use our digital learning environment or interact with our partner and support services. This policy explains the main categories of processing, the legal bases we rely on and the service providers involved.
1. Controller
Cranfield Aviation Training School (Deutschland) GmbH
Technologie Zentrum Dortmund · Building 1
Emil-Figge-Str. 76–80 · 44227 Dortmund · Germany
Phone: +49 (0)231 58699470
Email: info@theorieschule.aero
Managing Directors: Mariya Parashkevova & André Haufe
2. Categories of data and legal bases
Depending on the service used, we process contact data, customer and contract data, payment information, training and examination records, documents, communications, support information and technical usage or log data.
Processing is based, as applicable, on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (pre-contractual steps and performance of a contract), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interests, including secure operation, service improvement, communication and abuse prevention).
3. Website hosting and infrastructure
Our WordPress website is operated through Kinsta. The hosting environment selected by us is located in German data centres. In connection with website delivery, security and system administration, technical data such as IP addresses, timestamps, requested resources, browser information and server logs may be processed.
We additionally operate our own server and application infrastructure with IONOS. Depending on the application, this may include customer, training, application, file and technical log data.
We use Microsoft Azure for parts of our cloud, file, backup and application infrastructure. Depending on the relevant service, application data, files, backups and technical operating data may be processed.
4. Customer management and training operations
We use Zoho applications for customer relationship management, communication, document handling, service workflows and the organisation of business and training processes. This can include contact data, contractual information, training records, correspondence, documents, support history and workflow status information.
Training and examination records may be retained where required by contractual, statutory or aviation-regulatory documentation obligations.
5. Microsoft 365
We use Microsoft 365 / Exchange Online for business email. This can involve sender and recipient information, message content, attachments and technical metadata.
We use SharePoint as a central file and collaboration environment. Customer, contractual, training, company and project documents may be stored and processed there.
We use Microsoft Teams for meetings, communication and collaboration. Depending on how the service is used, participant details, audio/video data, chat content, shared documents and technical connection data may be processed.
6. Zoom
We use Zoom for online instruction, meetings and communication. Depending on the meeting format, names, email addresses, meeting metadata, audio/video data, chat messages, shared content and technical connection information may be processed. The legal basis depends on the context and may include Art. 6(1)(b), Art. 6(1)(f) and, where required, Art. 6(1)(a) GDPR.
7. Website analytics, advertising and conversion tracking
Google Analytics & Google advertising conversion tracking
We use Google Analytics to understand how visitors use our website. Subject to your consent settings, this may include information about page views, session activity, approximate location derived from technical data, device/browser information and interactions with our website.
We also use conversion tracking in connection with advertising campaigns that we run through Google services. This allows us to measure whether an advertising click or campaign interaction leads to a defined action on our website, for example an enquiry, form submission or course-related conversion. Where consent is legally required, analytics and advertising-related tracking is activated only after the corresponding consent has been given.
We use Google Tag Manager to manage and deploy website tags. Tag Manager itself primarily controls the technical delivery of tags, while the services triggered through it may process personal data according to their own purpose and consent status.
We also use Zoho-based analytics and tracking functions to evaluate website usage, customer journeys and interactions with our digital services. Depending on the configuration, this may involve page views, interaction events, technical device data, referrer information, session information and links to customer or lead records where such attribution is permitted.
8. Contact and enrolment forms
When you contact us or enrol for training through a website form, we process the information you provide in order to answer your request, take pre-contractual steps, administer an enrolment or perform a contract. Data may subsequently be transferred into our customer and training administration systems.
9. Recipients and international data transfers
Personal data is shared only where necessary for contract performance, legal or regulatory obligations, consent-based processing or legitimate business interests. Recipients can include IT and cloud providers, communication providers, payment providers, professional advisers, partner ATOs and competent authorities.
Where personal data is transferred outside the EEA, we use the safeguards applicable to the relevant provider and processing activity, which may include adequacy decisions, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses and supplementary measures.
10. Retention and security
We retain personal data only for as long as necessary for the relevant purpose or for as long as statutory, tax, commercial, contractual or aviation-regulatory retention requirements apply. We use appropriate technical and organisational measures in line with Art. 32 GDPR to protect confidentiality, integrity and availability.
11. Your rights
Subject to the requirements of the GDPR, you may have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent may be withdrawn with future effect under Art. 7(3) GDPR. You also have the right to lodge a complaint with a competent data protection supervisory authority under Art. 77 GDPR.
To exercise your rights, contact info@theorieschule.aero.
12. Cookie consent & your choices
On your first visit, our consent dialog (Borlabs Cookie) asks which service categories you allow. Essential services are always active, as the website cannot function without them. You can change or revoke your consent at any time with effect for the future:
The following overview lists the services used on this website, including providers, purposes and storage periods:
Your consent record for this device:
13. Updates to this policy
We update this Privacy Policy when our services, technology stack or legal requirements change. The version published on this website is the current version.
